Skip to content

Commit 4578531

Browse files
son-ozson-oz
authored
chore: security (#40)
* chore: update SECURITY.md * chore: add OpenSSF Security Scorecard
1 parent 91b88ea commit 4578531

3 files changed

Lines changed: 86 additions & 2 deletions

File tree

‎.github/workflows/scorecard.yml‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
---
2+
# This workflow uses actions that are not certified by GitHub. They are provided
3+
# by a third-party and are governed by separate terms of service, privacy
4+
# policy, and support documentation.
5+
name: Scorecard supply-chain security
6+
on:
7+
# For Branch-Protection check. Only the default branch is supported. See
8+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
9+
branch_protection_rule:
10+
# To guarantee Maintained check is occasionally updated. See
11+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
12+
schedule:
13+
- cron: 27 19 * * 5
14+
push:
15+
branches:
16+
- main
17+
# Declare default permissions as read only.
18+
permissions: read-all
19+
jobs:
20+
analysis:
21+
name: Scorecard Analysis
22+
runs-on: ubuntu-latest
23+
permissions:
24+
# Needed to upload the results to code-scanning dashboard.
25+
security-events: write
26+
# Needed to publish results and get a badge (see publish_results below).
27+
id-token: write
28+
# Uncomment the permissions below if installing in a private repository.
29+
# contents: read
30+
# actions: read
31+
steps:
32+
- name: Harden Runner
33+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
34+
with:
35+
egress-policy: audit
36+
- name: Checkout code
37+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4.5.4
38+
with:
39+
persist-credentials: false
40+
- name: Run analysis
41+
uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
42+
with:
43+
results_file: results.sarif
44+
results_format: sarif
45+
publish_results: true
46+
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
47+
# format to the repository Actions tab.
48+
- name: Upload artifact
49+
uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
50+
with:
51+
name: SARIF file
52+
path: results.sarif
53+
retention-days: 5
54+
- name: Upload SARIF to GitHub Code Scanning
55+
uses: github/codeql-action/upload-sarif@0499de31b99561a6d14a36a5f662c2a54f91beee # v3.29.5
56+
with:
57+
sarif_file: results.sarif

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
[![Generic badge](https://img.shields.io/badge/Compact%20Compiler-0.26.0-1abc9c.svg)](https://docs.midnight.network/relnotes/compact/minokawa-0-18-26-0)
22
[![Contributor Covenant](https://img.shields.io/badge/Contributor%20Covenant-2.1-4baaaa.svg)](CODE_OF_CONDUCT.md)
3+
[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/OpenZeppelin/compact-tools/badge)](https://api.securityscorecards.dev/projects/github.com/OpenZeppelin/compact-tools)
34

45
# OpenZeppelin Compact Tools
56

‎SECURITY.md‎

Lines changed: 28 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,33 @@
11
# Security
22

3-
Security vulnerabilities should be disclosed to the project maintainers by email to <security@openzeppelin.com>.
3+
Security vulnerabilities should be [disclosed](#reporting-a-vulnerability) to the [project maintainers](./.github/CODEOWNERS), or alternatively by email to security@openzeppelin.com.
4+
5+
## Supported Versions
6+
7+
The following versions are currently supported and receive security updates. Alpha, Beta and Release candidates will not receive security updates.
8+
9+
Security patches will be released for the latest minor of a given major release. For example, if an issue is found in versions >=1.13.0 and the latest is 1.14.0, the patch will be released only in version 1.14.1.
10+
11+
Only critical severity bug fixes will be backported to past major releases.
12+
13+
| Version | Supported |
14+
| --------- | ------------------ |
15+
| >= 1.x.x | :white_check_mark: |
16+
| <= 0.x.x | :x: |
17+
18+
## Reporting a Vulnerability
19+
20+
We're extremely grateful for security researchers and users that report vulnerabilities to us.
21+
All reports are thoroughly investigated by the project's security team.
22+
23+
Vulnerabilities are reported privately via GitHub's [Security Advisories](https://docs.github.com/en/code-security/security-advisories) feature.
24+
Please use the following link to submit your vulnerability: [Report a vulnerability](https://github.com/openzeppelin/midnight-apps/security/advisories/new)
25+
26+
Please see
27+
[Privately reporting a security vulnerability](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability#privately-reporting-a-security-vulnerability)
28+
for more information on how to submit a vulnerability using GitHub's interface.
429

530
## Legal
631

7-
Blockchain is a nascent technology and carries a high level of risk and uncertainty. OpenZeppelin makes certain software available under open source licenses, which disclaim all warranties in relation to the project and which limits the liability of OpenZeppelin. Subject to any particular licensing terms, your use of the project is governed by the terms found at [www.openzeppelin.com/tos](https://www.openzeppelin.com/tos) (the "Terms"). As set out in the Terms, you are solely responsible for any use of the project and you assume all risks associated with any such use. This Security Policy in no way evidences or represents an ongoing duty by any contributor, including OpenZeppelin, to correct any issues or vulnerabilities or alert you to all or any of the risks of utilizing the project.
32+
Blockchain is a nascent technology and carries a high level of risk and uncertainty. The software in this repository is made available under the MIT licenses, which disclaim all warranties in relation to the project and which limits the liability of OpenZeppelin. Subject to any particular licensing terms, your use of the project is governed by the terms found at [www.openzeppelin.com/tos](https://www.openzeppelin.com/tos) (the "Terms"). As set out in the Terms, you are solely responsible for any use of the project and you assume all risks associated with any such use. This Security Policy in no way evidences or represents an ongoing duty by any contributor, including OpenZeppelin, to correct any issues or vulnerabilities or alert you to all or any of the risks of utilizing the project.
33+

0 commit comments

Comments
 (0)